FinCEN Warns on Ghost Student Fraud and Synthetic Identities

The Financial Crimes Enforcement Network (FinCEN) issued an alert on 24 July 2026 urging financial institutions to detect, prevent and report suspicious activity linked to organised fraud against student aid programmes administered by the US Federal government. The alert, FIN-2026-Alert004, sets out two principal typologies and a set of transactional indicators drawn from Bank Secrecy Act (BSA) reporting.

The first typology concerns so-called "ghost students". Fraud rings obtain Personally Identifiable Information (PII) unlawfully and use it to impersonate identity theft victims, enrolling fabricated students at educational institutions and drawing down aid disbursements in their names. FinCEN notes that rings are increasingly using artificial intelligence and comparable tooling to defeat identity verification, generating documents that combine genuine stolen PII with fabricated attributes to produce synthetic identities. Victims, including minors, are typically unaware that their data is being used at all.

The second typology involves "straw students" — complicit individuals who sell their PII for a fee and are then enrolled by the ring, which collects the resulting aid refunds. FinCEN describes organised networks of such individuals, and flags insider facilitation by corrupt staff at educational institutions who recruit straw students and manipulate academic records to sustain eligibility.

On detection, FinCEN points institutions towards refund payments made either directly by educational institutions or through contracted intermediaries. Intermediary payments typically arrive by Automated Clearing House (ACH) transfer, with transaction references containing the term "refund" alongside the institution's name or abbreviation, and sometimes the stated recipient. Proceeds are then laundered through money mules, shell companies and fraudulently opened accounts. Reported red flags include accounts receiving refunds referencing multiple unrelated students, newly opened accounts funded exclusively by aid disbursements, multiple accounts accessed from a single foreign IP address, and refunds rapidly converted into cryptoassets or wired offshore.

For UK institutions, the immediate relevance is not the US reporting obligation but the laundering stage. Proceeds of fraud against a US Federal programme constitute criminal property for the purposes of the Proceeds of Crime Act 2002 where the underlying conduct would be an offence if committed in the UK, and dual-criminality is plainly satisfied. Inbound remittances, mule account activity and cryptoasset conversion touching UK-regulated firms therefore engage the full range of principal money laundering offences and the section 330 obligation to submit a Suspicious Activity Report to the National Crime Agency (NCA). UK banking groups with US retail operations, and firms providing correspondent or US dollar clearing services to smaller American institutions and education payment intermediaries, carry the more direct exposure.

The typologies themselves also warrant domestic reflection. The Student Loans Company (SLC) identified more than 3,500 suspicious applications worth close to £60 million in the 2022-23 academic year, concentrated among franchised higher education providers where enrolment and application processes were conducted online with minimal verification, and the Public Sector Fraud Authority (PSFA) has since been engaged. The structural weakness FinCEN describes — remote enrolment, thin identity assurance and disbursement mechanics that separate the payee from any genuine course of study — is common to both systems.

Practically, the alert supports three control-side actions. First, treat education-related refund credits as a discrete transaction monitoring category rather than folding them into generic government payments, and test scenarios for concentration of unrelated named beneficiaries. Second, revisit synthetic identity detection at onboarding, given the documented use of generative tooling against document-based verification; device, IP and behavioural signals carry more weight where document integrity can no longer be assumed. Third, ensure mule typology work — including counter-mule referrals and account closure decisions — accounts for benefit and grant fraud proceeds, which are frequently modelled separately from authorised push payment losses despite overlapping mule infrastructure.

Read the press release here.